ENCRYPTION DEVICE, ENCRYPTED TEXT CONVERSION DEVICE, ENCRYPTION PROGRAM, ENCRYPTED TEXT CONVERSION PROGRAM, ENCRYPTION METHOD, AND ENCRYPTED TEXT CONVERSION METHOD

Abstract

 An encryption device (500) includes an encryption unit (504), a detection element generation unit (505), and a transmission unit (506). The encryption unit (504) encrypts a plain text by using one of a pair of keys to generate an encrypted text into which the plain text has been encrypted and which can be subjected to homomorphic computation. The detection element generation unit (505) generates a detection element E used to detect a change in the encrypted text by using the one key and the encrypted text. The transmission unit (506) transmits the encrypted text and the detection element.

Description

Technical Field

[0001] The present invention relates to homomorphic encryption. The invention relates to an encryption device, an encrypted text conversion device, an encryption program, an encrypted text conversion program, an encryption method, and an encrypted text conversion method, each of which uses homomorphic encryption.

Background Art

[0002] When data is encrypted, it is normally impossible to read and edit data inside unless the data is decrypted. Therefore, in order to edit data in a plurality of encrypted texts, it is necessary to decrypt the plurality of encrypted texts once, extract plain texts as data, then edit the plain texts, and encrypt the plain texts again. On the contrary, in homomorphic encryption, it is possible to edit data in an encrypted text without decrypting the encrypted text. Processing at that time is referred to as "homomorphic computation", and a type that can be subjected to homomorphic computation and the number of times of homomorphic computation are changed depending on a specific method.

[0003] As homomorphic encryption, there are proposed homomorphic encryption in which only addition or multiplication can be performed, such as ElGamal encryption and Pailier encryption, and Gentry encryption or the like in which addition and multiplication can be executed without limitation. In those methods, as a first point, encrypted texts need to be generated by using the same public key when homomorphic computation is performed. As a second point, an encrypted text that has not been subjected to homomorphic computation yet is computed while being encrypted, and therefore it is problematic in that, even in a case where a plain text is changed by homomorphic computation, such a change cannot be detected.

[0004] Some methods for solving such a problem are proposed (see, for example, Patent Literature 1 and Non-Patent Literature 1).

Citation List

Patent Literature

[0005] Patent Literature 1: WO2014/010202 A1

Non-Patent Literature

[0006] Non-Patent Literature 1: Keita Emura, Goichiro Hanaoka, Go Ohtake, Takahiro Matsuda, Shota Yamada: Chosen Ciphertext Secure Keyed-Homomorphic Public-Key Encryption. Public Key Cryptography 2013: 32-50

Summary of Invention

Technical Problem

[0007] In a method disclosed in Patent Literature 1, encrypted texts generated by using a plurality of different keys are changed to encrypted texts having a single specified key by a technology referred to as "proxy re-encryption" and are subjected to homomorphic computation.

[0008] However, in this method, safety of encrypted texts that have not been subjected to homomorphic computation yet is low, and therefore it is problematic in that plain text data is changeable.

[0009] In another method disclosed in Non-Patent Literature 1, although a special key is needed to perform homomorphic computation, strength of safety of encrypted texts that have not been subjected to homomorphic computation yet is improved. Specifically, falsification of plain text data is prevented.

[0010] However, this method is problematic in that a user who can decrypt encrypted texts that have been subjected to homomorphic computation can also decrypt encrypted texts that have not been subjected to homomorphic computation yet.

[0011] As described above, in Patent Literature 1 and Non-Patent Literature 1, content of a plain text of an encrypted text that has not been subjected to homomorphic computation yet may be changed.

[0012] In view of this, an object of the invention is to provide a device, a program, and a method for detecting a change in an encrypted text that has not been subjected to homomorphic computation yet.

Solution to Problem

[0013] An encryption device according to the present invention includes:

an encryption unit to encrypt a plain text M by using one of a pair of keys to generate an encrypted text D into which the plain text M is encrypted and which can be subjected to homomorphic computation;

a detection element generation unit to generate a detection element E used to detect a change in the encrypted text D by using the one key and the encrypted text D; and

an output unit to output the encrypted text D and the detection element E. Advantageous Effects of Invention

[0014] The invention employs a detection element for detecting a change in an encrypted text in a homomorphic encryption technology capable of computing data while the data is being encrypted and can therefore detect a change in an encrypted text that has not been subjected to homomorphic computation yet. This makes it possible to achieve the use of safe homomorphic computation using an unchanged genuine encrypted text.

Brief Description of Drawings

[0015] 

Fig. 1 is a diagram of Embodiment 1 and is a block diagram illustrating a configuration of a confidential analysis system.

Fig. 2 is a diagram of Embodiment 1 and is a lock diagram of a common parameter generation device.

Fig. 3 is a diagram of Embodiment 1 and is a block diagram of a first key generation device.

Fig. 4 is a diagram of Embodiment 1 and is a lock diagram of a second key generation device.

Fig. 5 is a diagram of Embodiment 1 and is a block diagram of an encryption device.

Fig. 6 is a diagram of Embodiment 1 and is a block diagram of a conversion key generation device.

Fig. 7 is a diagram of Embodiment 1 and is a lock diagram of an encrypted text conversion device.

Fig. 8 is a diagram of Embodiment 1 and is a block diagram of a homomorphic computation device.

Fig. 9 is a diagram of Embodiment 1 and is a block diagram of a first decryption device.

Fig. 10 is a diagram of Embodiment 1 and is a block diagram illustrating a second decryption device.

Fig. 11 is a diagram of Embodiment 1 and is a flowchart illustrating processing of the common parameter generation device.

Fig. 12 is a diagram of Embodiment 1 and is a flowchart illustrating processing of the first key generation device.

Fig. 13 is a diagram of Embodiment 1 and is a flowchart illustrating processing of the second key generation device.

Fig. 14 is a diagram of Embodiment 1 and is a flowchart illustrating processing of the encryption device.

Fig. 15 is a diagram of Embodiment 1 and is a flowchart illustrating processing of the conversion key generation device.

Fig. 16 is a diagram of Embodiment 1 and is a flowchart illustrating processing of the encrypted text conversion device.

Fig. 17 is a diagram of Embodiment 1 and is a flowchart illustrating processing of the homomorphic computation device.

Fig. 18 is a diagram of Embodiment 1 and is a flowchart illustrating processing of the first decryption device.

Fig. 19 is a diagram of Embodiment 1 and is a flowchart illustrating processing of the second decryption device.

Fig. 20 is a diagram of Embodiment 1 and illustrates input and output of data in the confidential analysis system.

Fig. 21 is a diagram of Embodiment 1 and is a diagram illustrating a hardware configuration of the common parameter generation device and the like.

Fig. 22 is a diagram of Embodiment 1 and is another diagram illustrating a hardware configuration of the common parameter generation device and the like.

Description of Embodiments

Embodiment 1

[0016] Hereinafter, a key generation device 300 and the like are referred to as follows.

(1) Embodiment 1 discloses a key generation device 300 for generating a pair of a public key pk and a decryption key sk (secret key). This key generation device 300 is referred to as "first key generation device 300".

(2) The public key pk and the decryption key sk generated by the first key generation device 300 are referred to as "first public key pk" and "first decryption key sk". Note that those keys are also referred to as "public key pk" and "decryption key sk".

(3) Embodiment 1 discloses a post-homomorphic-computation key generation device 400 for generating a pair of a public key epk and a decryption key esk (secret key). This post-homomorphic-computation key generation device 400 is referred to as "second key generation device".

(4) The public key epk and the decryption key esk generated by the second key generation device are referred to as "second public key epk" and "second decryption key esk". Note that those keys are also referred to as "public key epk" and "decryption key esk".

(5) Embodiment 1 discloses a decryption device 900 for decrypting an encrypted text by using the first decryption key sk. This decryption device 900 is referred to as "first decryption device".

(6) Embodiment 1 discloses a decryption device 1000 for decrypting an encrypted text that has been subjected to homomorphic computation by using the second decryption key esk. This decryption device 1000 is referred to as "second decryption device".

[0017] Fig. 1 is a block diagram illustrating a configuration of a confidential analysis system 100. As illustrated in Fig. 1, the confidential analysis system 100 includes a common parameter generation device 200, a plurality of first key generation devices 300, a plurality of second key generation devices 400, an encryption device 500, a conversion key generation device 600, an encrypted text conversion device 700, a homomorphic computation device 800, the first decryption device 900, and the second decryption device 1000.

[0018] The confidential analysis system 100 may be achieved in such a way that the common parameter generation device 200 to the second decryption device 1000 are connected not via Internet 101 but via a local area network (LAN) provided in the same company.

[0019] The Internet 101 is a communication channel for connecting the common parameter generation device 200, the plurality of first key generation devices 300, the plurality of second key generation devices 400, the encryption device 500, the conversion key generation device 600, the encrypted text conversion device 700, the homomorphic computation device 800, the first decryption device 900, and the second decryption device 1000. The Internet 101 is an example of a network. Another type of network may be used instead of the Internet 101.

[0020] The common parameter generation device 200 generates a common parameter pub that is a common parameter to be used in the system and transmits the common parameter pub to the plurality of first key generation devices 300, the plurality of second key generation devices 400, the encryption device 500, the conversion key generation device 600, the encrypted text conversion device 700, the homomorphic computation device 800, the first decryption device 900, and the second decryption device 1000 via the Internet 101. Note that this common parameter pub may be provided via a mail, a bulletin board on a website, or the like instead of the Internet 101.

[0021] Note that it is assumed that, in a case where acquisition of the common parameter pub is not described in the following description of the encryption device 500 and the like, the common parameter pub has already been acquired.

[0022] Each first key generation device 300 may be a personal computer. The first key generation device 300 is a computer that generates the public key pk and the decryption key sk, transmits the public key pk to the encryption device 500, the encrypted text conversion device 700, and the first decryption device 900, and transmits the decryption key sk to the conversion key generation device 600 and the first decryption device 900.

[0023] Each second key generation device 400 may be a personal computer. The second key generation device 400 is a computer that generates the second public key epk and the second decryption key esk, transmits the second public key epk to the conversion key generation device 600 and the homomorphic computation device 800, and transmits the second decryption key esk to the second decryption device 1000.

[0024] The encryption device 500 functions as an encryption device of data and may be a personal computer. The encryption device 500 is a computer that receives the public key pk from the first key generation device 300, accepts input of a plain text M from the outside, and outputs an encrypted text C.

[0025] The conversion key generation device 600 may be a personal computer. The conversion key generation device 600 is a computer that receives the decryption key sk from the first key generation device 300 and the second public key epk from the second key generation device 400, generates a conversion key rk, and transmits the conversion key rk to the encrypted text conversion device 700.

[0026] The encrypted text conversion device 700 may be a personal computer. The encrypted text conversion device 700 is a computer that receives the conversion key rk from the conversion key generation device 600, accepts input of the encrypted text C, acquires the public key pk, generates a converted encrypted-text RC into which the encrypted text C is converted, and outputs the converted encrypted-text RC.

[0027] The homomorphic computation device 800 may be a personal computer. The homomorphic computation device 800 is a computer that receives the second public key epk from the second key generation device 400, accepts input of a plurality of converted encrypted-texts RC, and outputs encrypted texts EC (hereinafter, encrypted texts EC) that have been subjected to homomorphic computation.

[0028] The first decryption device 900 may be a personal computer. The first decryption device 900 is a computer that receives the decryption key sk from the first key generation device 300, acquires the public key pk, accepts input of the encrypted text C, and outputs a decryption result of the encrypted text C.

[0029] The second decryption device 1000 may be a personal computer. The second decryption device 1000 is a computer that receives the second decryption key esk from the second key generation device 400, accepts input of the encrypted texts EC, and outputs a decryption result of the encrypted texts EC.

[0030] Note that two or more of the first key generation device 300, the decryption device 900, and the conversion key generation device 600 may be simultaneously included in the same personal computer.

[0031] Note that the second key generation device 400 and the second decryption device 1000 may be simultaneously included in the same personal computer.

[0032] Note that two or more of the conversion key generation device 600, the encrypted text conversion device 700, and the homomorphic computation device 800 may be simultaneously included in the same personal computer.

<***Description of configuration***>

[0033] Hereinafter, a configuration of this embodiment will be described.

[0034] As illustrated in Fig. 1, the confidential analysis system 100 includes the common parameter generation device 200, the plurality of first key generation devices 300, the plurality of second key generation devices 400, the encryption device 500, the conversion key generation device 600, the encrypted text conversion device 700, the homomorphic computation device 800, the first decryption device 900, and the second decryption device 1000.

[0035] Fig. 2 to Fig. 10 are block diagrams illustrating configurations of the common parameter generation device 200, the first key generation device 300, the second key generation device 400, the encryption device 500, the conversion key generation device 600, the encrypted text conversion device 700, the homomorphic computation device 800, the first decryption device 900, and the second decryption device 1000, each of which is a computer.

[0036] Fig. 21 is a diagram illustrating a hardware configuration of the common parameter generation device 200 to the second decryption device 1000.

[0037] In this embodiment, the common parameter generation device 200, the first key generation devices 300, the second key generation devices 400, the encryption device 500, the conversion key generation device 600, the encrypted text conversion device 700, the homomorphic computation device 800, the first decryption device 900, and the second decryption device 1000 are computers.

[0038] The common parameter generation device 200, the first key generation devices 300, and the second key generation devices 400 include hardware such as a processor 91, an input interface 93, and an output interface 94. The encryption device 500 to the second decryption device 1000 include hardware such as the processor 91, a storage device 92, the input interface 93, and the output interface 94. Hereinafter, the input interface 93 and the output interface 94 are referred to as "input I/F 93" and "output I/F 94".

[0039] Fig. 2 to Fig. 10 illustrate a relationship between each function unit and hardware. In Fig. 2 to Fig. 10, the "... unit" serving as the processor 91 is achieved by software. In other words, the "... unit" serving as the processor 91 is achieved by the processor 91 executing software. Further, the "storage unit" in Fig. 5 to Fig. 10 is achieved by the storage device 92.

[0040] The processor 91 is connected to other pieces of hardware via a signal line and controls those other pieces of hardware. The processor 91 is an integrated circuit (IC) for performing processing. The processor 91 is specifically a central processing unit (CPU).

[0041] The storage device 92 includes an auxiliary storage device 92a and a memory 92b. The auxiliary storage device 92a is specifically a read only memory (ROM), a flash memory, or a hard disk drive (HDD). The memory 92b is specifically a random access memory (RAM).

[0042] The input I/F 93 is a port through which signals are input. Further, the input I/F 93 may be a port to be connected to an input device such as a mouse, a keyboard, and a touchscreen. The input I/F 93 is specifically a universal serial bus (USB) terminal. Note that the input interface 93 may be a port to be connected to a local area network (LAN).

[0043] The output I/F 94 is a port through which signals are output. The output I/F 94 may be a USB terminal.

[0044] The auxiliary storage device 92a stores a program that achieves a function of the "... unit" serving as the processor 91. This program is loaded into the memory 92b, is read by the processor 91, and is executed by the processor 91. The auxiliary storage device 92a also stores an operating system (OS). At least part of the OS is loaded into the memory 92b, and the processor 91 executes the program that achieves the function of the "unit" serving as the processor 91 while executing the OS.

[0045] The common parameter generation device 200 to the second decryption device 1000 may include only a single processor 91 or may include a plurality of processors 91. The plurality of processors 91 may cooperatively execute the program that achieves the function of the "unit".

[0046] Information indicating a result of processing by the function of the "unit" serving as the processor 91, data, signal values, and variable values are stored on the auxiliary storage device 92a, the memory 92b, or a register or cache memory in the processor 91.

[0047] The program that achieves the function of the "unit" serving as the processor 91 may be stored on portable record media such as a magnetic disc, a flexible disk, an optical disc, a compact disk, and a digital versatile disc (DVD).

[0048] Fig. 2 is a block diagram illustrating a configuration of the common parameter generation device 200. As illustrated in Fig. 2, the common parameter generation device 200 includes an input unit 201, a common parameter generation unit 202, and a transmission unit 203. Although not illustrated, the common parameter generation device 200 includes a recording medium storing data to be used in each unit of the common parameter generation device 200. The input unit 201 accepts input of a bit length L_bit of a key to be used in this system. Next, the common parameter generation unit 202 generates the common parameter pub that is a basic part of computation used in this system. Although not illustrated, the common parameter generation unit 202 may have a function of generating random sampling numbers in order to generate the common parameter pub. The transmission unit 203 transmits the common parameter pub generated in the common parameter generation unit 202 to the plurality of first key generation devices 300, the plurality of second key generation devices 400, the encryption device 500, the conversion key generation device 600, the encrypted text conversion device 700, the homomorphic computation device 800, the first decryption device 900, and the second decryption device 1000.

[0049] Fig. 3 is a block diagram illustrating a configuration of the first key generation device 300. As illustrated in Fig. 3, the first key generation device 300 includes an input unit 301, a key generation unit 302, and a key transmission unit 303. Although not illustrated, the first key generation device 300 includes a recording medium storing data to be used in each unit of the first key generation device 300. The input unit 301 accepts input of the common parameter pub. Next, the key generation unit 302 generates the pair of the first public key pk and the first decryption key sk. Although not illustrated, the key generation unit 302 may have a function of generating random sampling numbers in order to generate pk and sk. The key transmission unit 303 transmits the first public key pk generated in the key generation unit 302 to the encryption device 500, the encrypted text conversion device 700, and the first decryption device 900 and transmits the generated first decryption key sk to the conversion key generation device 600 and the first decryption device 900.

[0050] Fig. 4 is a block diagram illustrating a configuration of the second key generation device 400. As illustrated in Fig. 4, the second key generation device 400 includes an input unit 401, a key generation unit 402, and a key transmission unit 403. Although not illustrated, the second key generation device 400 includes a recording medium storing data to be used in each unit of the second key generation device 400. The input unit 401 accepts input of the common parameter pub. The key generation unit 402 generates the pair of the second public key epk and the second decryption key esk. Although not illustrated, the key generation unit 402 may have a function of generating random sampling numbers in order to generate the second public key epk and the second decryption key esk. The key transmission unit 403 transmits the second public key epk generated in the key generation unit 402 to the conversion key generation device 600 and the homomorphic computation device 800 and transmits the generated second decryption key esk to the second encrypted text decryption device 1000.

[0051] Fig. 5 is a block diagram illustrating a configuration of the encryption device 500. As illustrated in Fig. 5, the encryption device 500 includes a reception unit 501, a storage unit 502, an input unit 503, an encryption unit 504, a detection element generation unit 505, and a transmission unit 506. Although not illustrated, the encryption device 500 includes a recording medium storing data to be used in each unit of the encryption device 500. The reception unit 501 accepts input of the first public key pk. The storage unit 502 stores the first public key pk. The input unit 503 accepts input of the plain text M from the outside. The encryption unit 504 generates an encrypted text D on the basis of the first public key pk stored on the storage unit 502 and the plain text M input to the input unit 503. Although not illustrated, the encryption unit 504 may have a function of generating random sampling numbers in order to generate the encrypted text D. The detection element generation unit 505 generates a detection element E on the basis of the encrypted text D and the first public key pk. Although not illustrated, the detection element generation unit 505 may have a function of generating random sampling numbers in order to generate the detection element E. The transmission unit 506 outputs the encrypted text C = (D, E). In other words, the transmission unit 506 outputs a pair of the encrypted text D and the detection element E as the encrypted text C.

[0052] Fig. 6 is a block diagram illustrating a configuration of the conversion key generation device 600. As illustrated in Fig. 6, the conversion key generation device 600 includes a reception unit 601, a storage unit 602, an input unit 603, a conversion key generation unit 604, and a transmission unit 605. Although not illustrated, the conversion key generation device 600 includes a recording medium storing data to be used in each unit of the conversion key generation device 600. The reception unit 601 receives the decryption key sk. Next, the storage unit 602 stores the decryption key sk. The input unit 603 accepts input of the second public key epk. The conversion key generation unit 604 generates the conversion key rk on the basis of the first decryption key sk stored on the storage unit 602 and the second public key epk input to the input unit 603.

[0053] In other words,
rk = RKG (epk, sk) is satisfied.

[0054] The symbol "RKG" is a computation symbol showing generation of the conversion key rk. Although not illustrated, the conversion key generation unit 604 may have a function of generating random sampling numbers in order to generate the conversion key rk. The transmission unit 605 transmits the conversion key rk to the encrypted text conversion device 700.

[0055] Fig. 7 is a block diagram illustrating a configuration of the encrypted text conversion device 700. As illustrated in Fig. 7, the encrypted text conversion device 700 includes a reception unit 701, a storage unit 702, an input unit 703, a change detection unit 704, an encrypted text conversion unit 705, and a transmission unit 706. Although not illustrated, the encrypted text conversion device 700 includes a recording medium storing data to be used in each unit of the encrypted text conversion device 700.

[0056] The reception unit 701 receives the conversion key rk. The storage unit 702 stores the conversion key rk. The input unit 703 accepts input of the encrypted text C = (D, E) and the first public key pk. The change detection unit 704 verifies, by using the first public key pk, whether or not the plain text M of the encrypted text C input to the input unit 703 has been changed. The encrypted text conversion unit 705 generates the converted encrypted-text RC on the basis of the conversion key rk stored on the storage unit 702 and the encrypted text C input to the input unit 703. In a case where the change detection unit 704 detects a change, the encrypted text conversion unit 705 substitutes a special symbol indicating the change for the converted encrypted-text RC as the converted encrypted-text RC. In a case where the change detection unit 704 does not detect the change, the encrypted text conversion unit 705 generates the converted encrypted-text RC. Although not illustrated, the encrypted text conversion unit 705 may have a function of generating random sampling numbers in order to generate the converted encrypted-text RC. The transmission unit 706 outputs the converted encrypted-text RC.

[0057] Fig. 8 is a block diagram illustrating a configuration of the homomorphic computation device 800. As illustrated in Fig. 8, the homomorphic computation device 800 includes a reception unit 801, a storage unit 802, an input unit 803, a homomorphic computation unit 804, and a transmission unit 805. Although not illustrated, the homomorphic computation device 800 includes a recording medium storing data to be used in each unit of the homomorphic computation device 800. The reception unit 801 receives the converted encrypted-text RC. The storage unit 802 stores a plurality of converted encrypted-texts RC received by the reception unit 801. The input unit 803 accepts input of the second public key epk. The homomorphic computation unit 804 generates the encrypted texts EC on the basis of all the converted encrypted-texts RC stored on the storage unit 802 and the second public key epk input to the input unit 803. Although not illustrated, the homomorphic computation unit 804 may have a function of generating random sampling numbers and the like in order to generate the encrypted texts EC. The transmission unit 805 outputs the encrypted texts EC.

[0058] Fig. 9 is a block diagram illustrating a configuration of the first decryption device 900. As illustrated in Fig. 9, the first decryption device 900 includes a reception unit 901, a storage unit 902, an input unit 903, a decryption processing unit 904, and a transmission unit 905. Although not illustrated, the first decryption device 900 includes a recording medium storing data to be used in each unit of the first decryption device 900. The reception unit 901 accepts input of the decryption key sk. The storage unit 902 stores the decryption key sk received by the reception unit 901. The input unit 903 accepts input of the encrypted text C (D, E) and the public key pk. The decryption processing unit 904 generates the decryption result M of the encrypted text C on the basis of the decryption key sk stored on the storage unit 902 and the encrypted text C input to the input unit 903. The transmission unit 905 outputs the decryption result M.

[0059] Fig. 10 is a block diagram illustrating a configuration of the second decryption device 1000. As illustrated in Fig. 10, the second decryption device 1000 includes a reception unit 1001, a storage unit 1002, an input unit 1003, a decryption processing unit 1004, and a transmission unit 1005. Although not illustrated, the second decryption device 1000 includes a recording medium storing data to be used in each unit of the second decryption device 1000. The reception unit 1001 accepts input of the second decryption key esk. The storage unit 1002 stores the second decryption key esk received by the reception unit 1001. The input unit 1003 accepts input of the encrypted texts EC. The decryption processing unit 1004 generates a decryption result EM of the encrypted texts EC on the basis of the second decryption key esk stored on the storage unit 1002 and the encrypted texts EC input to the input unit 1003. The transmission unit 1005 outputs the decryption result EM.

[0060] Hereinafter, operation of each device corresponding to a calculation method in each device of this embodiment will be described.

[0061] Description will be provided also with reference to Fig. 20. Fig. 20 illustrates input and output of data in the confidential analysis system 100.

[0062] Fig. 11 is a flowchart illustrating operation of the common parameter generation device 200. As illustrated in Fig. 20, the common parameter generation device 200 receives the bit length L_bit of a key, generates the common parameter pub, and outputs the common parameter pub.

[0063] In Step S201, the input unit 201 receives the bit length L_bit of the key.

[0064] In Step S202, based on the bit length L_bit of the key, the common parameter generation unit 202 generates an element BG = (p, G, G_T, e) that can be subjected to pairing computation.

[0065] Herein,
the symbol "p" denotes order of a group G and a group G_T.

[0066] The symbol "e" is a bilinear mapping having a mapping of G × G → G_T. The bilinear mapping is a mapping in which e(g^a, g^b) = e(g, g)^ab ∈ G_T is satisfied for all g ∈ G, and a, b ∈ Z_p. This computation using e is referred to as "pairing computation". Note that Z_p is an aggregation of integers of mod = p.

[0067] In Step S203, the common parameter generation unit 202 generates a hash function H and a hash function key k.

[0068] In Step S204, the common parameter generation unit 202 selects g from the group G at random and selects u, v, and w ∈ Z_p at random.

[0069] In Step S205, the common parameter generation unit 202 calculates

and generates the common parameter pub = (BG, g, U, V, W, P, k).

[0070] In Step S206, the transmission unit 203 outputs the common parameter pub. Note that the transmission unit 203 is an output unit, and is assumed to perform transmission via the Internet 101 as illustrated in Fig. 1. However, the transmission unit 203 may be included therein and output the common parameter pub to a storage medium or may output the common parameter pub to an attached storage medium. The same applies to all the transmission units described below.

[0071] Fig. 12 is a flowchart illustrating operation of the first key generation device 300. As illustrated in Fig. 20, the first key generation device 300 receives the common parameter pub, generates the first public key pk and the first decryption key sk by using the common parameter pub, and outputs the first public key pk and the first decryption key sk.

[0072] In Step S301, the input unit 301 receives the common parameter pub.

[0073] In Step S302, the key generation unit 302 selects a decryption key sk ∈ Zp at random.

[0074] In Step S303, the key generation unit 302 calculates a public key pk = g^sk.

[0075] In Step S304, the key transmission unit 303 transmits the public key pk and the decryption key sk.

[0076] Fig. 13 is a flowchart showing operation of the second key generation device 400. As illustrated in Fig. 20, the second key generation device 400 receives the common parameter pub, generates the second public key epk and the second decryption key esk by using the common parameter pub, and outputs the second public key epk and the second decryption key esk. The second public key epk is used to generate the conversion key rk and encrypt the encrypted-text RC to the encrypted text EC. The second decryption key esk is used to decrypt the encrypted text EC.

[0077] In Step S401, the input unit 401 receives the common parameter pub.

[0078] In Step S402, the key generation unit 402 selects a decryption key esk ∈ Z_p at random by using the common parameter pub.

[0079] In Step S403, the key generation unit 402 calculates a public key epk = g^esk.

[0080] In Step S404, the key transmission unit 403 transmits the second public key epk and the second decryption key esk.

[0081] Fig. 14 is a flowchart illustrating operation of the encryption device 500. An encryption method using the encryption device 500 will be described with reference to Fig. 14. As illustrated in Fig. 20, the encryption device 500 receives the common parameter pub and the public key pk. Further, the encryption device 500 acquires the plain text M. The encryption device 500 generates and outputs the encrypted text C.

[0082] In Step S501, the reception unit 501 receives the common parameter pub and the public key pk. The storage unit 502 stores the common parameter pub and the public key pk.
The input unit 503 receives the plain text M.

[0083] In Step S502, the encryption unit 504 selects random sampling numbers r and s ∈ Z_p at random by using the common parameter pub.

[0084] In Step S503, the encryption unit 504 encrypts the plain text M by using the first public key pk that is one of the pair of keys, thereby generating the encrypted text D into which the plain text M is encrypted and which can be subjected to homomorphic computation.

[0085] Specifically, the encryption unit 504 calculates



for the encrypted text D.

is satisfied. Herein, the symbol "-" denotes multiplication defined in the group G.

[0086] In Expression 1 and Expression 2,
the symbol "M" is the plain text.

[0087] The symbol "P" is pairing computation P included in the common parameter pub.

[0088] The random sampling number r is selected in S502.

[0089] The symbol "pk" is the first public key pk.

[0090] As described above, the encryption unit 504 selects the first random sampling number r and the second random sampling number s and generates the encrypted text D by using not only the first public key pk but also the first random sampling number r and the common parameter pub.

[0091] Further, the detection element generation unit 505 generates the detection element E used to detect a change in the encrypted text D by using the first public key pk and the encrypted text D = (C₀, C₁).
Specifically, the detection element generation unit 505 calculates

[0092] In (Expression 3) and (Expression 4),
the right side "H(k, (pk, C₀, C₁))" in Expression 3 indicates that (pk, C₀, C₁) is encrypted by using the hash function H and the hash key k. Information of the hash function H and the hash key k is included in the common parameter pub. The symbols "U", "V", and "W" on the right side of Expression 4 are included in the common parameter pub. The symbol "t" is obtained by Expression 3, and the random sampling number r and the random sampling number s are random sampling numbers in S502. The random sampling number r is referred to as "first random sampling number", and the random sampling number s is referred to as "second random sampling number". As shown in Expression 3 and Expression 4, the detection element generation unit 505 generates the detection element E by using not only the first public key pk and the encrypted text D but also the first random sampling number r, the second random sampling number s, and the common parameter pub.

[0093] In Step S504, the transmission unit 506 outputs C = (C₀, C₁, s, C₂).

is satisfied. Herein, C₀ and C₁ correspond to the encrypted text D, and C₂ corresponds to the detection element E.

[0094] The transmission unit 506, which is an output unit, outputs the encrypted text D and the detection element E.

[0095] Fig. 15 is a flowchart illustrating operation of the conversion key generation device 600. As illustrated in Fig. 20, the conversion key generation device 600 receives the common parameter pub, the first decryption key sk, and the second public key epk and generates and outputs the conversion key rk.

[0096] In Step S601, the reception unit 601 receives the decryption key sk, and the storage unit 602 stores the decryption key sk. The input unit 603 receives the second public key epk.

[0097] In Step S602, the conversion key generation unit 604 calculates

[0098] The conversion key rk is generated on the basis of the second public key epk paired with the second secret key esk (second decryption key) which is used to decrypt a computation result of homomorphic computation in a case where the encrypted text D is subjected to homomorphic computation and the first decryption key sk (first secret key).

[0099] In Step S603, the transmission unit 605 outputs the conversion key rk.

[0100] Fig. 16 is a flowchart illustrating operation of the encrypted text conversion device 700. An encrypted text conversion method using the encrypted text conversion device 700 will be described with reference to Fig. 16. As illustrated in Fig. 20, the encrypted text conversion device 700 receives the common parameter pub, the first public key pk, the conversion key rk, and C = (D, E) = (C₀, C₁, s, C₂), converts the encrypted text C into the encrypted-text RC, and outputs the encrypted-text RC.

[0101] In Step S701, the reception unit 701 receives the conversion key rk. The storage unit 702 stores the conversion key rk, the common parameter pub, the first public key pk, and the like. The conversion key rk is used for conversion into the converted encrypted-text RC that is an encrypted text different from the encrypted text D. The input unit 703 receives the encrypted text C = (D, E) and the first public key pk. The encrypted text C includes the encrypted text D into which the plain text M has been encrypted and the detection element E. The encrypted text D can be subjected to homomorphic computation. As described above, the input unit 703, which is an acquisition unit, acquires the encrypted text D into which the plain text M is encrypted and which can be subjected to homomorphic computation and the detection element E used to detect a change in the encrypted text D.

[0102] In Step S702,
the change detection unit 704 calculates

[0103] The expression "t' = H(k, (pk, C₀, C₁))"
means that (pk, C₀, C₁) is encrypted by using the hash function H and the hash key k. The symbols "C₀" and "C₁" are included in the encrypted text C.

[0104] In Step S703, the change detection unit 704 verifies whether or not

is satisfied. In a case where e(C₂, pk) = e(C₁, (U^sV^t'W)) is satisfied, i.e., a change is not detected, the processing proceeds to Step S705. In a case where e(C₂, pk) = e(C₁, (U^sV^t'W)) is not satisfied, i.e., a change is detected, the processing proceeds to Step S704.

[0105] As described above, the change detection unit 704 generates a reference value e(C₂, pk), which is a reference used to determine whether or not the encrypted text D has been changed, on the basis of C₂ that is the detection element E and generates a collation value e(C₁, (U^sV^t'W)), which is to be collated with the reference value, on the basis of the encrypted text D. The collation value e(C₁, (U^sV^t'W)) includes

[0106] In t', the symbols "C₀" and "C₁" are the encrypted text D.

[0107] Therefore, the collation value e(C₁, (U^sV^t'W)) is generated on the basis of the encrypted text D.
The change detection unit 704 collates the reference value with the collation value.

[0108] More specifically, the change detection unit 704 generates the reference value e(C₂, pk) on the basis of the detection element E and the first public key pk and generates the collation value e(C₁, (U^sV^t'W)) on the basis of the first public key pk and the encrypted text D.

[0109] In Step S704, RC = ⊥ is satisfied in the encrypted text conversion unit 705.

[0110] The symbol "⊥" is a special symbol indicating failure of conversion and may be any symbol as long as the symbol specifies that conversion of an encrypted text fails.

[0111] In Step S705, the encrypted text conversion unit 705 calculates

and generates a converted encrypted-text RC = (C₀, C'₁) = (M·P^r, e(pk^r, rk)). As described above, in a case where a change in the encrypted text D is not detected as a result of collation using the change detection unit 704, the encrypted text conversion unit 705, which is a conversion unit, converts the encrypted text D into the converted encrypted-text RC converted from the encrypted text D by using the conversion key rk.

[0112] In Step S706, the transmission unit 706, which is an output unit, outputs the converted encrypted-text RC = (C₀, C'₁).

[0113] Fig. 17 is a flowchart illustrating operation of the homomorphic computation device 800. As illustrated in Fig. 20, the homomorphic computation device 800 receives the common parameter pub, the second public key epk, and a plurality (n) of RCs. Each of the n RCs is denoted by RCⁱ.

[0114] In Step S801, the reception unit 801 receives the encrypted-texts RC that have been converted, and the storage unit 802 stores the encrypted-texts RC. Then, the input unit 803 receives the second public key epk.

[0115] In Step S802, the homomorphic computation unit 804 selects
a random sampling number r' ∈ Z_p.

[0116] In Step S803, the homomorphic computation unit 804 newly calculates C₀ and C'₁ on the left side in the following expressions.

[0117] In the following expressions, it is assumed that a request for results of homomorphic computation obtained in the following expressions has been issued. The homomorphic computation unit 804 computes the following expressions in response to this request.



are calculated.

[0118] In Step S804, the transmission unit 805 outputs

which is the encrypted text EC that has been subjected to the above homomorphic computation.

[0119] Fig. 18 is a flowchart illustrating operation of the first decryption device 900.

[0120] As illustrated in Fig. 20, the first decryption device 900 receives the common parameter pub, the first public key pk, the first decryption key sk, and the encrypted text C = (C₀, C₁, s, C₂). The first decryption device 900 decrypts the encrypted text C to the plain text M.

[0121] In Step S901, the reception unit 901 receives the common parameter pub, the first public key pk, and the first decryption key sk. The storage unit 902 stores the common parameter pub, the first public key pk, and the first decryption key sk. The input unit 903 receives the encrypted text C.

[0122] In Step S902, the decryption processing unit 904 calculates

[0123] In Step S903, the decryption processing unit 904 verifies whether or not

is satisfied. In a case where e(C₂, pk) = e(C₁, (U^sV^t'W)) is satisfied, the processing proceeds to Step S905. In a case where e(C₂, pk) = e(C₁, (U^sV^t'W)) is not satisfied, the processing proceeds to Step S904.

[0124] In Step S904,

is satisfied in the decryption processing unit 904. The symbol "⊥" is a special symbol indicating failure of conversion and may be any symbol as long as the symbol specifies that conversion of an encrypted text fails.

[0125] In Step S905, the decryption processing unit 904 calculates

[0126] In Step S906, the transmission unit 905 outputs a decryption result M.

[0127] Fig. 19 is a flowchart illustrating operation of the second decryption device 1000. As illustrated in Fig. 20, the second decryption device 1000 accepts the common parameter pub, the second secret key esk, and the encrypted text EC = (C₀, C'₁). The second decryption device 1000 decrypts the encrypted text EC and outputs the decryption result EM.

[0128] In Step S1001, the reception unit 1001 receives the second decryption key esk, and the storage unit 1002 stores the second decryption key esk. The input unit 1003 receives the encrypted text EC that has been subjected to homomorphic computation.

[0129] In Step S1002, the decryption processing unit 1004 calculates

[0130] In Step S1003, the transmission unit 1005 outputs the decryption result EM.

<***Description of effects of Embodiment 1***>

[0131] This embodiment has the following effects.

(1) In this embodiment, even data encrypted by using different public keys can be converted into encrypted texts having the same second public key epk by using a conversion key. With this, it is possible to compute plain texts by using a homomorphic computation device while information of the individual encrypted texts are being kept secret.

(2) In this embodiment, the plain text M in the encrypted text C cannot be changed because a verification expression using t is used in decryption processing in the decryption device to check the encrypted text C. However, by using the conversion key, encrypted texts can be converted into encrypted texts of the same second public key epk. Therefore, it is possible to compute plain texts by using the homomorphic computation device while information of the individual encrypted texts are being kept secret.

(3) In this embodiment, although safety of the encrypted text C using the public key pk can be extremely high, it is possible to compute the plain text M while the encrypted text C is being kept secret. Therefore, it is possible to achieve a safe confidential analysis system.

(4) The encryption device causes the encrypted text C to include not only the encrypted text D but also the detection element E for detecting a change in the encrypted text D. Therefore, it is possible to prevent a change in the encrypted text D.

(5) In a case where whether or not the encrypted text D has been changed is verified by using the detection element E and then it is determined that the encrypted text D has not been changed, the encrypted text conversion device converts the encrypted text C into the encrypted-text RC. Therefore, it is possible to provide the encrypted text C that has not been changed to the homomorphic computation device.

***Other configurations***

[0132] Further, in this embodiment, the function of the "unit" serving as the processor 91 is achieved by software. However, the function of the "unit" serving as the processor 91 may be achieved by hardware as a modification example.

[0133] Fig. 22 illustrates a case where the function of the "unit" serving as the processor 91 is achieved by a processing circuit 99 that is hardware. The processing circuit 99 is connected to a signal line 99a. The processing circuit 99 achieves the function of the "unit" serving as the processor 91 described above and a function of the "storage unit". The processing circuit 99 is a dedicated electronic circuit that achieves the function of the "unit" serving as the processor 91 and the function of the "storage unit". The processing circuit 99 is specifically a single circuit, multiple circuits, a programmed processor, multiple programmed processors, a logic IC, a gate array (GA), an application specific integrated circuit (ASIC), or a field-programmable gate array (FPGA).

[0134] The function of the "unit" serving as the processor 91 may be achieved by a single processing circuit 99 or may be dispersively achieved by a plurality of processing circuits 99.

[0135] As another modification example, the devices illustrated in Fig. 2 to Fig. 10 may be achieved by a combination of software and hardware. That is, part of functions of the devices illustrated in Fig. 2 to Fig. 10 may be achieved by dedicated hardware, and remaining functions thereof may be achieved by software.

[0136] The processor 91, the storage device 92, and the processing circuit 99 are collectively referred to as "processing circuitry". In other words, the function of the "unit" serving as the processor 91 and the "storage unit" in Fig. 2 to Fig. 10 are achieved by the processing circuitry.

[0137] The "unit" serving as the processor 91 may be read as "step", "procedure", or "processing". Further, the function of the "unit" serving as the processor 91 may be achieved by firmware.

[0138] Further, operation of the common parameter generation device 200 to the second decryption device 1000 illustrated in Fig. 2 to Fig. 10 can be grasped as methods and programs. The encryption device 500 is operated by an encryption program. Operation of the encryption device 500 is an encryption method. Further, the encrypted text conversion device 700 is operated by an encrypted text conversion program. Operation of the encrypted text conversion device 700 is an encrypted text conversion method.

[0139] Note that, although the public key pk and the decryption key sk are used in Embodiment 1, a role of the public key pk and a role of the decryption key may be switched and the public key pk may be used for decryption. The same applies to the public key epk and the decryption key esk.

Reference Signs List

[0140] pub: common parameter, RC: encrypted-text, pk: first public key, sk: first decryption key, epk: second public key, esk: second decryption key, rk: conversion key, 91: processor, 92: storage device, 93: input I/F, 94: output I/F, 99: processing circuit, 99a: signal line, 100: confidential analysis system, 101: Internet, 200: common parameter generation device, 201: input unit, 202: common parameter generation unit, 203: transmission unit, 300: first key generation device, 301: input unit, 302: key generation unit, 303: key transmission unit, 400: second key generation device, 401: input unit, 402: key generation unit, 403: key transmission unit, 500: encryption device, 501: reception unit, 502: storage unit, 503: input unit, 504: encryption unit, 505: detection element generation unit, 506: transmission unit, 600: conversion key generation device, 601: reception unit, 602: storage unit, 603: input unit, 604: conversion key generation unit, 605: transmission unit, 700: encrypted text conversion device, 701: reception unit, 702: storage unit, 703: input unit, 704: change detection unit, 705: encrypted text conversion unit, 706: transmission unit, 800: homomorphic computation device, 801: reception unit, 802: storage unit, 803: input unit, 804: homomorphic computation unit, 805: transmission unit, 900: first decryption device, 901: reception unit, 902: storage unit, 903: input unit, 904: decryption processing unit, 905: transmission unit, 1000: second decryption device, 1001: reception unit, 1002: storage unit, 1003: input unit, 1004: decryption processing unit, 1005: transmission unit.

Claims

1. An encryption device comprising:

an encryption unit to encrypt a plain text M by using one of a pair of keys to generate an encrypted text D into which the plain text M is encrypted and which can be subjected to homomorphic computation;

a detection element generation unit to generate a detection element E used to detect a change in the encrypted text D by using the one key and the encrypted text D; and

an output unit to output the encrypted text D and the detection element E.

2. The encryption device according to claim 1,
wherein the one key is a first public key pk of a pair of the first public key pk and a first secret key sk.

3. The encryption device according to claim 2, further comprising
a storage unit to store a common parameter pub,
wherein:

the encryption unit

selects a first random sampling number r and a second random sampling number s and generates the encrypted text D by using not only the first public key pk but also the first random sampling number r and the common parameter pub; and

the detection element generation unit

generates the detection element E by using not only the first public key pk and the encrypted text D but also the first random sampling number r, the second random sampling number s, and the common parameter pub.

4. An encrypted text conversion device comprising:

an acquisition unit to acquire an encrypted text D into which a plain text M is encrypted and which can be subjected to homomorphic computation and a detection element E used to detect a change in the encrypted text D;

a storage unit to store a conversion key rk used for conversion into a converted encrypted-text RC that is an encrypted text different from the encrypted text D;

a change detection unit to generate a reference value that is a reference used to determine whether or not the encrypted text D has been changed on the basis of the detection element E, generate a collation value to be collated with the reference value on the basis of the encrypted text D, and collate the reference value with the collation value;

a conversion unit to convert the encrypted text D into the converted encrypted-text RC by using the conversion key rk in a case where a change in the encrypted text D is not detected as a result of collation using the change detection unit; and

an output unit to output the converted encrypted-text RC.

5. The encrypted text conversion device according to claim 4,
wherein:

the encrypted text D

is a text into which the plain text M is encrypted by using a first public key pk paired with a first secret key sk;

the detection element E

is generated by using the first public key pk and the encrypted text D;

the conversion key rk

is generated on the basis of the first secret key sk and a second public key epk paired with a second secret key esk that is a decryption key used to decrypt a computation result of homomorphic computation in a case where the encrypted text D is subjected to homomorphic computation;

the storage unit

stores the first public key pk; and

the change detection unit

generates the reference value on the basis of the detection element E and the first public key pk and generates the collation value on the basis of the first public key pk and the encrypted text D.

6. An encryption program for causing a computer to execute:

processing of encrypting a plain text M by using one of a pair of keys to generate an encrypted text D into which the plain text M is encrypted and which can be subjected to homomorphic computation;

processing of generating a detection element E used to detect a change in the encrypted text D by using the one key pk and the encrypted text D; and

processing of outputting the encrypted text D and the detection element E.

7. An encrypted text conversion program for causing a computer to execute:

processing of acquiring an encrypted text D into which a plain text M is encrypted and which can be subjected to homomorphic computation and a detection element E used to detect a change in the encrypted text D;

processing of storing a conversion key rk used for conversion into a converted encrypted-text RC that is an encrypted text different from the encrypted text D;

processing of generating a reference value that is a reference used to determine whether or not the encrypted text D has been changed on the basis of the detection element E, generating a collation value to be collated with the reference value on the basis of the encrypted text D, and collating the reference value with the collation value;

processing of converting the encrypted text D into the converted encrypted-text RC by using the conversion key rk in a case where a change in the encrypted text D is not detected as a result of collation; and

processing of outputting the converted encrypted-text RC.

8. An encryption method performed by an encryption device including an encryption unit, a detection element generation unit, and an output unit,
wherein:

the encryption unit

encrypts a plain text M by using one of a pair of keys to generate an encrypted text D into which the plain text M is encrypted and which can be subjected to homomorphic computation;

the detection element generation unit

generates a detection element E used to detect a change in the encrypted text D by using the one key pk and the encrypted text D; and

the output unit outputs the encrypted text D and the detection element E.

9. An encrypted text conversion method performed by an encrypted text conversion device including an acquisition unit, a storage unit, a change detection unit, a conversion unit, and an output unit,
wherein:

the acquisition unit

acquires an encrypted text D into which a plain text M is encrypted and which can be subjected to homomorphic computation and a detection element E used to detect a change in the encrypted text D;

the storage unit

stores a conversion key rk used for conversion into a converted encrypted-text RC that is an encrypted text different from the encrypted text D;

the change detection unit

generates a reference value that is a reference used to determine whether or not the encrypted text D has been changed on the basis of the detection element E, generates a collation value to be collated with the reference value on the basis of the encrypted text D, and collates the reference value with the collation value;

the conversion unit

converts the encrypted text D into the converted encrypted-text RC by using the conversion key rk in a case where a change in the encrypted text D is not detected as a result of collation using the change detection unit; and

the output unit

outputs the converted encrypted-text RC.

Drawing